The chain, link by link
Links 4 and 5 are the ones that catch people out, because they change on a completely different schedule from the page. Somebody leaves the company on a Friday. Nobody edits any page. The set of humans who can read a particular document is now different.
Checking one page properly
For a single page, Confluence answers this well. Open the page, click the restrictions (padlock) control, and you will see who can view and who can edit, and whether the restriction applies because it was set here or because it was inherited from a page above.
Two things that view will not tell you, and both matter:
- Whether the named people and groups are still real. A deactivated user or an emptied group still appears in the list, looking exactly like a working grant.
- Whether this page is unusual. One page in isolation carries no context. Is this the only restricted page in the space, or one of four hundred? You cannot tell from here.
And to be clear about a common assumption: being a site administrator does not override a page restriction. Admin rights let you manage the site; they do not silently grant reading rights to content someone has restricted away from you.
Four ways the answer is already wrong
These are not hypotheticals; they are the states a restriction settles into over a couple of years of ordinary staff turnover. Each looks entirely normal in the restrictions dialog.
It names someone who has been deactivated
The person appears in the view list. They cannot read the page. If they were the only person granted access, then the honest answer to “who can see this page?” is nobody — while the interface shows a name.
It names a group with no members
A group is a promise that someone is in it. When the last member is removed, the restriction remains, well-formed and pointing at an empty set. This is the quietest of the four, because group membership is managed somewhere else entirely by somebody else.
It names a principal that no longer exists
The user or group has been deleted outright. The restriction still references it. Nothing in the page suggests anything is wrong.
Every grantee is dead, so the page is stranded
The compounding case, and the one worth finding first. When every user and group granted view access is deactivated, empty or deleted, the page’s intended audience is locked out completely. The content exists, people expect to find it, and only a site admin can now reach it — assuming one thinks to look.
It gets worse through inheritance: a stranded view restriction on a parent strands every page beneath it too. One dead group can quietly remove an entire documentation tree from the people who need it, without a single error message anywhere.
Answering it across the whole site
For one page, the padlock is enough. For “are we exposed anywhere?” or “did anything break since last quarter?”, you need the same check run everywhere at once — and Confluence Cloud has no site-wide view of restrictions to run it against.
Warden is Hullara’s access audit app for Confluence, and this is the job it does. It inventories every view- or edit-restricted page across the site, records who can view and edit each one and whether the restriction is direct or inherited, and flags exactly the four states above: deactivated user, empty group, orphaned principal, and the page-level consequence of no live viewer or no live editor.
From the second scan onwards you read a difference rather than a list: a banner says how many red flags are new and how many were resolved since last time, and each new finding is marked. That is what makes a quarterly review a short task instead of a re-reading of everything.
Warden is read-only — its manifest declares no write scope for Confluence content, so it cannot alter a restriction. It shows you the state and you decide what to do about it. The report is free at any team size; CSV export is the paid part.
Two limits, stated up front. Warden reports the current state — it cannot reconstruct who changed a restriction before it was installed, because no Forge app can see that history. And deactivated-user detection is best-effort under Runs on Atlassian, while the empty-group and orphaned-principal flags are exact.
Questions
Also worth reading: finding every restricted page in Confluence · what a Confluence permission audit actually means · the Warden user guide.